Commit e0f99afbdf00

Vincent Demeester <vincent@sbr.pm>
2026-01-20 22:41:47
fix(nix-flake-updater): disable SSH control master for systemd service
The service was failing with SSH socket errors: - "unix_listener: cannot bind to path ... Read-only file system" - "no such identity: ... No such file or directory" This is the same issue as nixpkgs-consolidate. Fixed by: 1. Setting GIT_SSH_COMMAND to disable SSH ControlMaster 2. Adding ~/tmp to ReadWritePaths for worktree creation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
main
1 parent 829173e
Changed files (1)
modules
nix-flake-updater
default.nix
modules/nix-flake-updater/default.nix
@@ -119,6 +119,7 @@ in
         Type = "oneshot";
         User = cfg.user;
         ExecStart = "${updateScript}";
+        Environment = ''"GIT_SSH_COMMAND=ssh -o ControlMaster=no"'';
 
         # Security hardening
         PrivateTmp = true;
@@ -127,6 +128,8 @@ in
         ReadWritePaths = [
           cfg.repoPath
           "/var/log/nix-flake-updater"
+          # Worktree location (script creates worktrees in ~/tmp)
+          "/home/${cfg.user}/tmp"
         ];
         NoNewPrivileges = true;